1. Field of the Invention
The present invention relates generally to digital networks, such as those through which services are provided to subscribers, and, more specifically, to digital network authentication processes in such networks.
2. Description of the Related Art
Digital service providers are using their networks to deliver an ever-broadening array of services to their subscribers' or customers' homes or other premises. Whereas once a digital subscriber line (DSL) was used solely to provide subscribers with Internet Web and e-mail access, today's service providers wish to bundle Internet service with voice (telephony) and video (television) services. (Such bundled Internet, voice and video service is sometimes colloquially referred to as “triple play” service.) Optical fiber-based technologies, such as the passive optical network (PON), offer perhaps even more promising alternatives to DSL. Fully optical networks, which some have referred to as “fiber-to-the-premises” (FTTP), are increasingly being developed and deployed.
As the complexity and value of digital services have increased, so has the need for security and convenience. The longstanding username-and-password login procedure for providing network security is increasingly considered unacceptable. More automated authentication alternatives have been proposed, and the IEEE 802.1x standard for port-based network access control has emerged as the most popular. “Authentication” refers generally to the process by which a network verifies that a client device attempting to access the network is authorized to access the network and blocks access if the authentication process indicates that the client device lacks authorization.
A service provider wishing to offer a new or additional service that was not previously available via its network may need to add physical devices to the network and otherwise configure the network to support the new service. For example, a service provider that offers only Internet access may wish to offer its customers television programming in addition to the Internet access. To do this, the service provider may need to add some hardware and software elements to its network.
One option for adding a new service would be for the service provider to modify its existing equipment to support the new feature or purchase new equipment that supports the new feature. In the case of a DSL network, the equipment might reasonably be the digital subscriber line access multiplexer (DSLAM) or, in the case of a PON, the optical line terminator (OLT) or optical network terminator (ONT), as each such device defines the access node through which the subscribers' devices (commonly referred to as customer premises equipment or CPE) access the network. Although modifying existing equipment or obtaining new equipment is one possible solution, it may not be the most economical. For example, the benefits of modifying the DSLAMs or OLTs in a typical network of this type may not outweigh the cost if there is insufficient customer demand for the new service.
Another option for adding a new service is for the service provider to add new equipment that supports the new feature and works in conjunction with the existing network equipment. In the case of a DSL network, the new equipment might need to be disposed in the path between the customer premises and the digital subscriber line access multiplexer (DSLAM) or, in the case of a PON, between the customer premises and the optical network terminator (ONT). In such an instance, data packets transmitted between the DSLAM (or OLT, etc.) and the customer premises would need to pass through the new equipment (which is commonly referred to, as a “service node”). As with any network device, it would be desirable to perform authentication when this new equipment is to be used, to ensure that it is connected to the type of device with which it needs to work in conjunction and also that it is in fact the service provider's equipment or otherwise authorized by the service provider and is not some unauthorized equipment that has been connected to the network. It would also be desirable for equipment connected in this manner to not interfere with the network's normal authentication of the CPE. The present invention addresses these problems and deficiencies and others in the manner described below.